Loading story…
Microsoft shipped a Windows 10 cumulative security update that turned on Enforcement mode for the Netlogon elevation-of-privilege flaw tracked as CVE-2020-1472, widely known as Zerologon. The update, released for Windows 10 versions 2004 and 20H2 as KB4601319, advanced Microsoft’s phased mitigation by requiring stricter Netlogon secure channel protections to address the critical Active Directory domain controller weakness.
The same release also delivered broader security fixes across Windows Authentication, Cryptography, Virtualization, Core Networking, and Cloud Infrastructure, and addressed a win32k elevation-of-privilege issue. Microsoft said the update was distributed through Windows Update, recommended installing servicing stack update KB4598481 first, and noted separate known issues involving Japanese IME Furigana behavior and a Discord Direct3D 12 overlay incompatibility.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft stated that as of September 12, 2023, KB4601319 was available only through Windows Update and no longer through the Microsoft Update Catalog or other release channels.
Microsoft said the February 9, 2021 release also contained updates for Microsoft HoloLens OS Build 19041.1136.
On February 9, 2021, Microsoft released KB4601319 for Windows 10 versions 2004 and 20H2. The cumulative update advanced mitigation for CVE-2020-1472 by enabling Enforcement mode and included additional security fixes.
Microsoft published a Security Update Guide entry for CVE-2020-1472, identified as the Netlogon Elevation of Privilege Vulnerability.
3 references tracked. Mallory keeps watching after this page renders.
support.microsoft.com
Open sourcedocs.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kroll published detection guidance for **CVE-2020-1472** (**Zerologon**), the critical Microsoft Netlogon flaw that allows attackers to compromise **Active Directory domain controllers**. The guidance followed Microsoft's advisory and focused on identifying whether attackers had already abused the bug in the wild, a risk highlighted by warnings from Microsoft, DHS, and the FBI, including reports of active exploitation by state-backed actors. The detection playbook describes three common attack paths: resetting a domain controller computer-account password and leaving it changed, resetting it and later restoring the original password, and using a **printer spooler plus NTLM relay** technique that avoids a password reset entirely. Kroll said defenders should review Windows security events including `4624`, `4742`, and in some cases `5805`, examine domain controller password-hash history for null-password resets or restored credentials, inspect **LSASS** memory with Yara-based methods, and use **Snort** or **Suricata** to spot scans and exploitation attempts on the network.
Aug 15, 2026
A critical Windows Netlogon remote code execution flaw, tracked as **`CVE-2026-41089`**, is being actively exploited against corporate networks, with attacks targeting Windows Server domain controllers. The vulnerability can be triggered through specially crafted Netlogon requests without authentication or user interaction, potentially allowing attackers to run arbitrary code with **SYSTEM-level privileges** and escalate to full domain compromise. Microsoft patched the issue in its May 2026 Patch Tuesday release, which addressed **118 vulnerabilities**, including **16 critical** flaws, and the **Centre for Cybersecurity Belgium** flagged the Netlogon bug as a priority because of confirmed in-the-wild exploitation. Organizations are being urged to immediately patch supported Windows Server versions from 2012 onward, restrict domain controllers from untrusted network exposure, and increase monitoring for suspicious Netlogon and authentication activity while reinforcing segmentation and access controls around domain controllers.
Jun 30, 2026
Microsoft’s May 2026 Patch Tuesday resolved between **120 and 137 vulnerabilities** across Windows, Office, networking services, Hyper-V, SharePoint Server, and Microsoft Dynamics 365 on-premises, including **17 to 30 critical flaws**. Microsoft said the release contained **no publicly disclosed or actively exploited zero-days**, but multiple high-risk issues affected core enterprise infrastructure. Notable vulnerabilities included unauthenticated remote code execution in **Windows Netlogon** (`CVE-2026-41089`) and the **Windows DNS Client** (`CVE-2026-41096`), a **Hyper-V guest-to-host escape**, a SharePoint Server RCE (`CVE-2026-40365`), and a **Dynamics 365 on-premises** RCE (`CVE-2026-42898`) rated **CVSS 9.9**. The update also addressed Office and endpoint attack paths, including Microsoft Word flaws and `CVE-2026-35421`, which could allow code execution through malicious **EMF** files opened in Microsoft Paint via Windows GDI. Security researchers said organizations should prioritize patching **domain controllers**, **DNS-exposed Windows systems**, **on-premises collaboration platforms**, and **user endpoints** because of their exposure and likely exploitability. Alongside the security fixes, Microsoft issued mandatory Windows 11 cumulative updates **KB5089549** and **KB5087420** for versions **25H2, 24H2, and 23H2**, adding platform changes such as File Explorer, accessibility, storage, printing, and secure batch file processing improvements.
Jun 29, 2026